How Certus protects your evidence
Security is layered into the product, the platform, and the people who operate it. Below is a condensed view of the control stack we share with auditors and customers.
Platform security
- Infrastructure runs in AWS us-east-2 with dedicated VPCs, private subnets, and security groups enforced by AWS Control Tower.
- All workloads require mutual TLS; audit pipeline artefacts are signed with customer-provided KMS keys or Certus-managed HSM.
- Runtime shielding policy blocks unsigned containers. Cosign signatures validated on every deploy.
Data protection
- Evidence ledger replicated across AZs. QLDB exports mirrored to customer-owned S3 on request.
- At-rest encryption via KMS multi-tenant keys (default) or customer-supplied keys (BYOK).
- Access to evidence bundles gated by attribute-based access control. Immutable trail stored for 7 years.
Operations & monitoring
- 24×5 on-call with 15 minute response SLA; optional 24×7 support for GA customers.
- P0 playbooks include automated evidence rehydration tests and pilot communication cadences.
- Quarterly tabletop exercises covering insider threats, supply chain compromise, and regulator escalations.